POP3 Connectivity Test
POP3 (Post Office Protocol v3) is one of the oldest email retrieval protocols and is still widely used by legacy clients and embedded devices. When users report that messages are not downloading, or clients are stuck on "authenticating" or "checking mail", a structured POP3 connectivity test helps pinpoint where the failure occurs: DNS, network reachability, TLS negotiation, authentication, or mailbox state.
Prerequisites
- Know the POP3 server hostname (for example,
mail.example.com).
- Determine the port:
110 for cleartext, 995 for POP3 over TLS (POP3S).
- Have a valid username and password, and confirm whether the server expects full email address or a local part.
Quick Connectivity Checks
First, confirm DNS resolves the hostname:
nslookup mail.example.com
Then verify basic reachability to the target port:
telnet mail.example.com 110
# or for TLS
openssl s_client -connect mail.example.com:995 -servername mail.example.com -showcerts
On port 110, a successful connection returns a banner such as +OK Dovecot ready. On port 995, the TLS handshake must succeed and report valid certificates. Mismatched SNI, expired certificates, or unsupported ciphers will cause failures.
Authentication and Retrieval
After connecting, test authentication manually to isolate client-side issues. Typical command flow:
USER your-username
+OK
PASS your-password
+OK Logged in
STAT
+OK 23 14567 # 23 messages, 14,567 bytes total
LIST 1
+OK 1 1234
RETR 1
+OK 1234 octets
... message content ...
QUIT
If you receive -ERR responses during USER or PASS, validate the credential format and ensure the account is not locked. Many servers require full email addresses (for example, user@example.com) rather than local usernames.
Common Errors and Fixes
- Time-outs: Often caused by firewalls, ISP port blocking, or NAT rules. Test from a different network and check server logs.
- TLS certificate errors: Fix hostname mismatch, expired or untrusted CA. Ensure the client uses SNI with the server’s FQDN.
- Authentication failures: Verify password, account status, and whether the server requires Application Passwords when MFA is enabled.
- Mailbox corrupted: Some servers report
-ERR internal error. Run server-side mailbox repair tools or recreate index files.
Security Considerations
Prefer POP3 over TLS on port 995. Disable cleartext logins over port 110 or enforce STLS if supported. Always validate certificates and avoid accepting self-signed certs in production.
When to Choose IMAP Instead
POP3 downloads and optionally deletes messages, which can fragment email history across devices. If users need multi-device synchronization, server-side folders, or message flags, IMAP is a better fit.
Next Steps
If basic testing succeeds but clients still fail, capture client logs, compare timestamps with server logs, and review rate limits or connection quotas. For comprehensive diagnosis, pair this with our SMTP and DNS tools from the EmailToolbox suite.
